On May 2, 2025, Governor Glenn Youngkin signed into law SB854 that amends the Virginia Consumer Data Protection Act (“VCDPA”). This new amendment seeks to limit the amount of time children and teens spend on social media and will go into effect on January 1, 2026. This comes shortly after previous updates to children’s privacy went into effect earlier this year.
This new law requires data controllers and processors that operate social media platforms to:
- Determine whether a user is younger than 16 years old, and
- Limit minors’ use to one hour per day and allow parents to increase or decrease the daily time limit
What are Social Media Platforms Under this new Law?
Under the new law, a social media platform is a “public or semipublic Internet-based service or application” with users in Virginia that:
- “Connects users in order to allow users to interact socially with each other within such service or application.” This does not include services and applications that solely provide email or direct messaging services.
- Allows users to do all of the following
- “Construct a public or semipublic profile for purposes of signing into and using such service or application;
- “Populate a public list of other users with whom such user shares a social connection within such service or application;” and
- “Create or post content viewable by other users, including content on message boards, in chat rooms, or through a landing page or main feed that presents the user with content generated by other users.” This does not interactive gaming and include services that consist primarily of news, sports, entertainment, ecommerce, or content preselected by the provider and not generated by the users.
A service or application must meet all of the criteria to be considered a social media platform for purposes of the new law.
How Do Controllers and Processers Determine Age?
Controllers and processors must use commercially reasonable methods to determine whether a user is younger than 16 years old. The new law suggests that a neutral age screen mechanism be implemented as a commercially reasonable method. For example, a prompt that asks a user to enter their date of birth would be permissible.
Unlike other parts of the VCDPA, this new addition to the law defines a minor as “any natural person younger than 16 years of age.” In other provisions of the VCDPA, the term “child” refers to those under the age of 13. Moreover, users must be treated as minors if the device signals that the user is younger than 16 years old. This determination can be made through browser plug-ins, privacy settings, device settings, and other mechanisms.
Are there Additional Obligations of Controllers and Processors?
As a result of this new law, social media platforms cannot withhold, degrade, lower the quality of, or increase the price of their services for minors just because they cannot use the platform for more than one hour per day.
What are the Possible Penalties for VCDPA Violations?
The Attorney General enforces the VCDPA and notifies controllers and processors of violations. After receiving a notice of the violation, controllers and processors have 30 days to inform the Attorney General that the violation has been cured. Otherwise, the Attorney General can seek civil penalties. Fines under the VCDPA can reach up to $2,500 per violation and $7,500 for intentional violations. Because each consumer or user represents a separate and distinct violation, businesses subject the VCDPA can face high fines if they have many users in the Commonwealth.
How Our Attorneys Can Help You
Our data and privacy attorneys can assist you and your business develop privacy compliance programs and policies, review your current plans, and help manage risk to your business. With these new updates to children’s privacy, it is important for platforms and companies to review their services and ensure compliance with the ever-changing legal landscape. It is important to act now before the law goes into effect to reduce your business’s risk of enforcement actions by the Attorney General. If you’re unsure whether your service is compliant, contact our office today.
